HAProxy DDoS 防护配置生成器

# HAProxy DDoS 防护配置 · 由防盾工具箱生成
# 安放路径: /etc/haproxy/haproxy.cfg

global
    log /dev/log local0
    maxconn 50000
    nbthread auto
    tune.bufsize 32768

defaults
    mode http
    log global
    option httplog
    option dontlognull
    timeout connect 5s
    timeout http-request 8s    # 关键: 慢速攻击防护, 请求头必须在 8s 内发完
    timeout http-keep-alive 10s
    timeout client 30s
    timeout server 30s

frontend ft_main
    bind *:80
    bind *:443 ssl alpn h2,http/1.1 crt=/etc/haproxy/certs/site.pem
    maxconn 2000

    # 已知恶意 UA 直接拒绝
    acl bad_ua hdr_sub(user-agent) -i "python-requests" "curl/" "go-http" ""
    http-request deny if bad_ua

    # L7 速率限制: 每 10s 窗口按源 IP 限速
    stick-table type ip size 200k expire 60s store http_req_rate(10s)
    http-request track-sc0 src
    http-request deny deny_status 429 if { sc_http_req_rate(0) gt 100 }

    # 质询 Cookie: 首次访问植入标记, 无法完成 JS 质询的客户端被拦截
    http-request set-var(txn.challenge) req.cook(dd_verify),sub("1")
    http-request deny deny_status 403 if !{ var(txn.challenge) -m found } !{ path_beg /dd-verify }

    default_backend bk_app

backend bk_app
    server app1 127.0.0.1:8080 check maxconn 1000

backend dd_verify
    # 质询页由静态服务提供, 返回带 Set-Cookie 的 JS 校验
    http-request return status 200 content-type "text/html" string "<script>document.cookie='dd_verify=1;path=/';location.reload()</script>"

# 校验: haproxy -c -f /etc/haproxy/haproxy.cfg
# 平滑重载: systemctl reload haproxy